The Ostorlab MCP server,
connected in one click.
Query and act on your Ostorlab scans, vulnerabilities, tickets and assets. Connect the official Ostorlab MCP server to Claude, ChatGPT, or Cursor through gate — one gateway URL, no config files, security-checked.
Free to start · No credit card · No hosting needed
Add Ostorlab to your AI in one minute
Pick your client. Copy, paste, done — or let gate handle sign-ins and policies for you.
claude mcp add --transport http ostorlab https://api.ostorlab.co/apis/mcp/{api_key}/Run in your terminal, then restart Claude Code.
Ostorlab · https://api.ostorlab.co/apis/mcp/{api_key}/
What your AI can do with Ostorlab
Real prompts you can type the moment it's connected — no setup, no docs to read.
“Use “me”: Describe the calling API key and the organisation it belongs to. The caller is an API key, not a user account. Args: ctx: The MCP requ.”
“Use “list_vulnerabilities”: List vulnerabilities for the authenticated organisation with optional filtering. Object-level scoping is performed at the scan level via th.”
“Use “search_vulnerabilities”: Find findings across every scan, filtered by application, date and severity. Reach for this whenever the question spans more than one scan.”
“Use “get_vulnerability”: Get detailed information for a single vulnerability by database id. Args: ctx: FastMCP Context holding connection path parameters.”
How secure is the Ostorlab MCP server?
Every server in the gate directory has to pass the same four checks before your AI can touch it. Here's how Ostorlab holds up.
Security grade F
gate scanned 268 tools on Oct 28, 2026. A few things are worth a look before you connect.
- mediumme: References secrets or data exfiltration
- mediumupdate_vulnerability: References secrets or data exfiltration
- mediumstop_scan: References secrets or data exfiltration
- +50 more in the full report
Official endpoint
Operated by Ostorlab (ostorlab.co) at its documented MCP endpoint — not a third-party mirror or community re-host.
No sign-in needed
This server only exposes public data — no account and no credentials are involved when you connect.
Scanned before it goes live
gate checks every tool for prompt injection, hidden instructions, data-exfiltration hints, and over-broad permissions before the server is available through your gateway.
Watched for drift
If Ostorlab adds or changes tools later, gate re-scans and alerts you — before your AI acts on the change.
Connected in three steps
Connect your gate
Add one gateway URL to Claude, ChatGPT, or any MCP client. One-time setup, about two minutes.
Pick Ostorlab
Choose Ostorlab in the gate directory. No sign-in needed.
Use it anywhere
Ostorlab's tools are live in every AI client you've connected — with rules and logging built in.
Free to start · No credit card · No hosting needed
The actual tools Ostorlab exposes
Fetched live from the official endpoint and re-checked daily by gate — not marketing copy.
me — Describe the calling API key and the organisation it belongs to. The caller is an API key, not a user account. Args: ctx: The MCP requ
list_vulnerabilities — List vulnerabilities for the authenticated organisation with optional filtering. Object-level scoping is performed at the scan level via th
search_vulnerabilities — Find findings across every scan, filtered by application, date and severity. Reach for this whenever the question spans more than one scan
get_vulnerability — Get detailed information for a single vulnerability by database id. Args: ctx: FastMCP Context holding connection path parameters.
update_vulnerability — Update a vulnerability's risk rating, CVSS vectors, or triage status. Mirrors the GraphQL ``customizeVulnerabilities`` mutation. With ``all
list_scans — List scans for the authenticated organisation with optional filtering. The non-archived path reuses ``query_helper.query_scans`` (the Graph
get_scan — Get detailed information for a single scan by database id. Access is resolved through ``shared_access.access.get_scan_with_access`` so obje
get_scan_status — Get a scan's progress state, start/end times and errors. Mirrors the GraphQL resolvers: ``state`` is the latest ``key="progress"`` value (`
+ 260 more tools once connected
Who runs the Ostorlab MCP server?
The Ostorlab MCP server at a glance
https://api.ostorlab.co/apis/mcp/{api_key}/Questions, answered
Is there an official Ostorlab MCP server?
Yes — Ostorlab operates its own remote MCP server at api.ostorlab.co. gate connects you to that official endpoint and adds security scanning, per-tool access rules, and an activity log on top.
How do I connect Ostorlab to Claude or ChatGPT?
Add gate's gateway URL to your AI client once, then pick Ostorlab in the directory. No account or sign-in is needed. From then on, Ostorlab's tools are available in every client you've connected to gate.
Do I need to host anything?
No. Ostorlab runs the server, and gate is fully managed. You just connect one URL — there's nothing to install, deploy, or maintain.
Is the Ostorlab MCP server safe to connect?
It's the vendor's official endpoint, and gate scans its tools for prompt injection and hidden instructions before it goes live, re-checks it whenever it changes, and lets you allow, block, or require approval for every single tool.
Is it free?
Yes — you can get started with gate for free and connect Ostorlab in minutes. No credit card required.
Connect more than just Ostorlab
Every server below works through the same gateway URL — connect once, add tools anytime.
Squarespace DomainsDesignView →Set up Ostorlab in: Claude · Claude Code · ChatGPT · Cursor · VS Code